Vulnerability · Published Mar 31, 2021 · Assigned by redhat
CVE-2021-3470
Medium 5.3
In plain English
A medium-severity memory corruption in redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.1%top 33.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | redis | 6.2.0-r0 | ALPINE-CVE-2021-3470 |
| Alpine:v3.21 | redis | 6.2.0-r0 | ALPINE-CVE-2021-3470 |
| Alpine:v3.22 | redis | 6.2.0-r0 | ALPINE-CVE-2021-3470 |
| Alpine:v3.23 | redis | 6.2.0-r0 | ALPINE-CVE-2021-3470 |
| Alpine:v3.24 | redis | 6.2.0-r0 | ALPINE-CVE-2021-3470 |
| Debian:12 | redis | 5:6.0.9-1 | DEBIAN-CVE-2021-3470 |
| Debian:13 | redis | 5:6.0.9-1 | DEBIAN-CVE-2021-3470 |
| Debian:14 | redis | 5:6.0.9-1 | DEBIAN-CVE-2021-3470 |
Affected products (as reported)
Weakness: CWE-119
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1943623 x_refsource_MISC